Skip to content

PMP Key Vault updates #12079

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
katarzyna-koltun-mx wants to merge 6 commits into
base: development
Choose a base branch
from
Open

PMP Key Vault updates #12079

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
125510b
PMP Key Vault updates
katarzyna-koltun-mx Oct 14, 2026
40d978e
sme review
katarzyna-koltun-mx Oct 19, 2026
7e7762b
Update pmp-key-vault-integration.md
katarzyna-koltun-mx Oct 23, 2026
0832479
Update ServiceAccount name in Key Vault integration docs
katarzyna-koltun-mx Oct 23, 2026
2938c06
Update pmp-key-vault-integration.md
katarzyna-koltun-mx Oct 23, 2026
ba934b3
Improve formatting in prerequisites for Key Vault integration
katarzyna-koltun-mx Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 39 additions & 35 deletions ...ent/en/docs/private-platform/secret-management/pmp-configure-azure-key-vault.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,99 +58,103 @@ When creating the JSON structure for your secret, you must use a flat key-value

* Bitbucket

* **VCS.BitbucketProjectAdminPAT** - Personal access token for the Bitbucket project admin
* **VCS.BitbucketAdminPassword** - Password for the Bitbucket admin user
* **VCS-BitbucketProjectAdminPAT** - Personal access token for the Bitbucket project admin
* **VCS-BitbucketAdminPassword** - Password for the Bitbucket admin user

* GitLab

* **VCS.GitlabGroupOwnerPAT** - Personal access token for the GitLab group owner
* **VCS.GitlabAdminPAT** - Personal access token for the GitLab admin
* **VCS-GitlabGroupOwnerPAT** - Personal access token for the GitLab group owner
* **VCS-GitlabAdminPAT** - Personal access token for the GitLab admin

* GitHub

* **VCS.GithubOrgOwnerPAT** - Personal access token for the GitHub organization owner
* **VCS.GithubAdminPAT** - Personal access token for the GitHub admin
* **VCS.GithubEnterpriseClientSecret** - Client secret for the GitHub Enterprise app
* **VCS-GithubOrgOwnerPAT** - Personal access token for the GitHub organization owner
* **VCS-GithubAdminPAT** - Personal access token for the GitHub admin
* **VCS-GithubEnterpriseClientSecret** - Client secret for the GitHub Enterprise app

* Azure

* **VCS.AzureDevOpsOrgAdminPAT** - Personal access token for the Azure DevOps organization owner
* **VCS.AzureAuthSecret** - Currently unused
* **VCS-AzureDevOpsOrgAdminPAT** - Personal access token for the Azure DevOps organization owner
* **VCS-AzureAuthSecret** - Currently unused

* Kubernetes Build Settings

* BuildPackage

* fileServerBasic

* **BuildPackage.FileBasicAuthPassword** - Password for the file server
* **BuildPackage-FileBasicAuthPassword** - Password for the file server

* AwsAKSK

* **BuildPackage.AwsSecretAccessKey** - AWS secret access key for the file server
* **BuildPackage-AwsSecretAccessKey** - AWS secret access key for the file server

* RuntimeBaseImage

* privateRegistry

* **RuntimeBaseImage.PrivateRegistryPassword** - Base image for the runtime
* **RuntimeBaseImage-PrivateRegistryPassword** - Base image for the runtime

* S3compatibleAccessKey

* **RuntimeBaseImage.S3CompatibleAccessKey** - S3-compatible access key for the base image
* **RuntimeBaseImage-S3CompatibleAccessKey** - S3-compatible access key for the base image

* MDAStorage

* fileServerBasic

* **MDAStorage.FileBasicAuthPassword** - Password for the file server
* **MDAStorage-FileBasicAuthPassword** - Password for the file server

* awsAKSK

* **MDAStorage.AwsSecretAccessKey** - AWS secret access key for the MDA storage
* **MDAStorage-AwsSecretAccessKey** - AWS secret access key for the MDA storage

* OCIRegistry

* privateRegistry

* **OCIRegistry.PrivateRegistryPassword** - Password for the private registry
* **OCIRegistry-PrivateRegistryPassword** - Password for the private registry

* S3compatibleAccessKey

* **OCIRegistry.S3CompatibleAccessKey** - S3 compatible access key for the OCI registry
* **OCIRegistry-S3CompatibleAccessKey** - S3 compatible access key for the OCI registry

* Build Cluster Settings

* **BuildCluster.KubernetesConfigureToken** - Token for the Kubernetes cluster configuration
* **CIAdmin.JenkinsConfigureAPIToken** - Token for the Jenkins configuration
* **CIAdmin.JenkinsTriggerAuthToken** - Token for the Jenkins trigger configuration
* **CIAdmin.AzureOrgAdminPAT** - Personal access token for the Azure DevOps configuration
* **CIAdmin.AzureBlobStorageToken** - SAS token for the Azure Blob Storage
* **CIAdmin.AzureAwsS3SK** - Name of the Azure DevOps organization
* **BuildCluster-KubernetesConfigureToken** - Token for the Kubernetes cluster configuration
* **CIAdmin-JenkinsConfigureAPIToken** - Token for the Jenkins configuration
* **CIAdmin-JenkinsTriggerAuthToken** - Token for the Jenkins trigger configuration
* **CIAdmin-AzureOrgAdminPAT** - Personal access token for the Azure DevOps configuration
* **CIAdmin-AzureBlobStorageToken** - SAS token for the Azure Blob Storage
* **CIAdmin-AzureAwsS3SK** - Name of the Azure DevOps organization

* **Cluster Manager**

* **ClusterManager.OCIRegistryAWSSK** - OCI Registry: AWS secret access key for the OCI registry
* **serverClusterManager.OCIBasicAuthPassword** - OCI Registry: Password for the OCI registry
* **serverClusterManager.MDAAWSSK** - MDA Storage: AWS secret access key for the MDA file
* **serverClusterManager.MDAFileBasicAuthPassword** - MDA Storage: Password for the MDA file
* **serverClusterManager.KubernetesApiToken** - Kubernetes API: Token for accessing the Kubernetes API
* **serverClusterManager.GrafanaAPIKey** - Grafana: API key for accessing the Grafana server
* **ClusterManager-OCIRegistryAWSSK** - OCI Registry: AWS secret access key for the OCI registry
* **serverClusterManager-OCIBasicAuthPassword** - OCI Registry: Password for the OCI registry
* **serverClusterManager-MDAAWSSK** - MDA Storage: AWS secret access key for the MDA file
* **serverClusterManager-MDAFileBasicAuthPassword** - MDA Storage: Password for the MDA file
* **serverClusterManager-KubernetesApiToken** - Kubernetes API: Token for accessing the Kubernetes API
* **serverClusterManager-GrafanaAPIKey** - Grafana: API key for accessing the Grafana server

* Marketplace

* **Marketplace.ImportCDNPassword** - Personal access token for the Marketplace admin
* **Marketplace-ImportCDNPassword** - Personal access token for the Marketplace admin

* Email

* **Email.SMTPPassword** - Password for the SMTP server
* **Email-SMTPPassword** - Password for the SMTP server

* Maia

* **Maia.AmazonBedrockApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom AWS Bedrock LLM
* **Maia.AzureAiApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom Azure LLM
* **Maia.AnthropicApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom Azure LLM
* **Maia.OpenAiApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom Azure LLM
* **Maia-AmazonBedrockApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom AWS Bedrock LLM
* **Maia-AzureAiApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom Azure LLM
* **Maia-AnthropicApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom Azure LLM
* **Maia-OpenAiApiKey** - An API key to allow [Maia](/private-mendix-platform/maia/) to connect to a custom Azure LLM

{{% alert color="info" %}}
Azure Key Vault secret names cannot contain underscores (`_`), periods (`.`), spaces, and special symbols. Private Mendix Platform converts any periods in a constant or runtime setting name to hyphens for the Key Vault entry (`objectName`). The `objectAlias` - that is, the file name actually mounted into the pod and read by the Mendix Runtime - always keeps the periods, exactly matching the format in the official documentation, for example, `mx-const-MyFirstModule.WelcomePageTitle`. Private Mendix Platform performs this conversion consistently both when it writes the value to Key Vault and when it builds the SecretProviderClass entry, so the two always stay in sync. However, other special characters are not automatically converted, so constant names that contain them cannot be stored in Azure Key Vault. Because of that, we recommend that you do not create secret names with underscores (`_`), periods (`.`), spaces, and special symbols.
{{% /alert %}}

### Configuring Azure AD Workload Identity

Expand Down
Loading
Loading